From e9d9c58dc3717419efe883b7819ad79281722c15 Mon Sep 17 00:00:00 2001 From: leeffo Date: Tue, 27 Sep 2022 10:41:35 +0800 Subject: [PATCH] fix CVE-2022-30974 CVE-2022-30975 (cherry picked from commit 00909060aee6fdf2577bf1576131a73a9829329b) --- ...stack-overflow-during-regexp-compila.patch | 64 +++++++++++++++++++ ...161-Don-t-fclose-a-FILE-that-is-NULL.patch | 25 ++++++++ ...-Cope-with-empty-programs-in-mujs-pp.patch | 54 ++++++++++++++++ mujs.spec | 15 ++++- 4 files changed, 157 insertions(+), 1 deletion(-) create mode 100644 0001-Issue-162-Check-stack-overflow-during-regexp-compila.patch create mode 100644 0002-Issue-161-Don-t-fclose-a-FILE-that-is-NULL.patch create mode 100644 0003-Issue-161-Cope-with-empty-programs-in-mujs-pp.patch diff --git a/0001-Issue-162-Check-stack-overflow-during-regexp-compila.patch b/0001-Issue-162-Check-stack-overflow-during-regexp-compila.patch new file mode 100644 index 0000000..173f612 --- /dev/null +++ b/0001-Issue-162-Check-stack-overflow-during-regexp-compila.patch @@ -0,0 +1,64 @@ +From 160ae29578054dc09fd91e5401ef040d52797e61 Mon Sep 17 00:00:00 2001 +From: Tor Andersson +Date: Tue, 17 May 2022 15:31:50 +0200 +Subject: [PATCH 1/3] Issue #162: Check stack overflow during regexp + compilation. + +Only bother checking during the first compilation pass that counts +the size of the program. +--- + regexp.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/regexp.c b/regexp.c +index 9d16867..8a43fef 100644 +--- a/regexp.c ++++ b/regexp.c +@@ -622,25 +622,26 @@ struct Reinst { + Reinst *y; + }; + +-static int count(struct cstate *g, Renode *node) ++static int count(struct cstate *g, Renode *node, int depth) + { + int min, max, n; + if (!node) return 0; ++ if (++depth > REG_MAXREC) die(g, "stack overflow"); + switch (node->type) { + default: return 1; +- case P_CAT: return count(g, node->x) + count(g, node->y); +- case P_ALT: return count(g, node->x) + count(g, node->y) + 2; ++ case P_CAT: return count(g, node->x, depth) + count(g, node->y, depth); ++ case P_ALT: return count(g, node->x, depth) + count(g, node->y, depth) + 2; + case P_REP: + min = node->m; + max = node->n; +- if (min == max) n = count(g, node->x) * min; +- else if (max < REPINF) n = count(g, node->x) * max + (max - min); +- else n = count(g, node->x) * (min + 1) + 2; ++ if (min == max) n = count(g, node->x, depth) * min; ++ else if (max < REPINF) n = count(g, node->x, depth) * max + (max - min); ++ else n = count(g, node->x, depth) * (min + 1) + 2; + if (n < 0 || n > REG_MAXPROG) die(g, "program too large"); + return n; +- case P_PAR: return count(g, node->x) + 2; +- case P_PLA: return count(g, node->x) + 2; +- case P_NLA: return count(g, node->x) + 2; ++ case P_PAR: return count(g, node->x, depth) + 2; ++ case P_PLA: return count(g, node->x, depth) + 2; ++ case P_NLA: return count(g, node->x, depth) + 2; + } + } + +@@ -903,7 +904,7 @@ Reprog *regcompx(void *(*alloc)(void *ctx, void *p, int n), void *ctx, + putchar('\n'); + #endif + +- n = 6 + count(&g, node); ++ n = 6 + count(&g, node, 0); + if (n < 0 || n > REG_MAXPROG) + die(&g, "program too large"); + +-- +2.20.1 + diff --git a/0002-Issue-161-Don-t-fclose-a-FILE-that-is-NULL.patch b/0002-Issue-161-Don-t-fclose-a-FILE-that-is-NULL.patch new file mode 100644 index 0000000..1d0863c --- /dev/null +++ b/0002-Issue-161-Don-t-fclose-a-FILE-that-is-NULL.patch @@ -0,0 +1,25 @@ +From 910acc807c3c057e1c0726160808f3a9f37b40ec Mon Sep 17 00:00:00 2001 +From: Tor Andersson +Date: Tue, 17 May 2022 15:53:30 +0200 +Subject: [PATCH 2/3] Issue #161: Don't fclose a FILE that is NULL. + +--- + pp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/pp.c b/pp.c +index bf6000c..2657369 100644 +--- a/pp.c ++++ b/pp.c +@@ -34,7 +34,7 @@ void js_ppfile(js_State *J, const char *filename, int minify) + + if (js_try(J)) { + js_free(J, s); +- fclose(f); ++ if (f) fclose(f); + js_throw(J); + } + +-- +2.20.1 + diff --git a/0003-Issue-161-Cope-with-empty-programs-in-mujs-pp.patch b/0003-Issue-161-Cope-with-empty-programs-in-mujs-pp.patch new file mode 100644 index 0000000..dbdb8de --- /dev/null +++ b/0003-Issue-161-Cope-with-empty-programs-in-mujs-pp.patch @@ -0,0 +1,54 @@ +From f5b3c703e18725e380b83427004632e744f85a6f Mon Sep 17 00:00:00 2001 +From: Tor Andersson +Date: Tue, 17 May 2022 15:57:00 +0200 +Subject: [PATCH 3/3] Issue #161: Cope with empty programs in mujs-pp. + +--- + jsdump.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/jsdump.c b/jsdump.c +index 86361e6..42c9f0f 100644 +--- a/jsdump.c ++++ b/jsdump.c +@@ -682,11 +682,13 @@ static void pstmlist(int d, js_Ast *list) + void jsP_dumpsyntax(js_State *J, js_Ast *prog, int dominify) + { + minify = dominify; +- if (prog->type == AST_LIST) +- pstmlist(-1, prog); +- else { +- pstm(0, prog); +- nl(); ++ if (prog) { ++ if (prog->type == AST_LIST) ++ pstmlist(-1, prog); ++ else { ++ pstm(0, prog); ++ nl(); ++ } + } + if (minify > 1) + putchar('\n'); +@@ -768,11 +770,13 @@ static void sblock(int d, js_Ast *list) + void jsP_dumplist(js_State *J, js_Ast *prog) + { + minify = 0; +- if (prog->type == AST_LIST) +- sblock(0, prog); +- else +- snode(0, prog); +- nl(); ++ if (prog) { ++ if (prog->type == AST_LIST) ++ sblock(0, prog); ++ else ++ snode(0, prog); ++ nl(); ++ } + } + + /* Compiled code */ +-- +2.20.1 + diff --git a/mujs.spec b/mujs.spec index 944c672..5a23a9b 100644 --- a/mujs.spec +++ b/mujs.spec @@ -1,6 +1,6 @@ Name: mujs Version: 1.2.0 -Release: 1 +Release: 2 Summary: An embeddable Javascript interpreter License: ISC URL: http://mujs.com/ @@ -8,6 +8,12 @@ URL: http://mujs.com/ # Github mirror of mujs.com repository provides releases from tags Source0: https://mujs.com/downloads/mujs-%{version}.tar.gz +# CVE-2022-30974 +Patch0001: 0001-Issue-162-Check-stack-overflow-during-regexp-compila.patch +Patch0002: 0002-Issue-161-Don-t-fclose-a-FILE-that-is-NULL.patch +# CVE-2022-30975 +Patch0003: 0003-Issue-161-Cope-with-empty-programs-in-mujs-pp.patch + BuildRequires: coreutils BuildRequires: gcc BuildRequires: grep @@ -29,6 +35,10 @@ This package provides the MuJS static library. %setup -q -n %{name}-%{version} chmod a-x -v docs/* +%patch0001 -p1 +%patch0002 -p1 +%patch0003 -p1 + %build make debug %{?_smp_mflags} XCFLAGS="%{optflags} -fPIC" LDFLAGS="%{?__global_ldflags}" @@ -49,6 +59,9 @@ make install DESTDIR=%{buildroot} prefix="%{_prefix}" libdir="%{_libdir}" \ %{_libdir}/lib%{name}.a %changelog +* Tue Sep 27 2022 liweiganga - 1.2.0-2 +- fix: fix CVE-2022-30974 CVE-2022-30974 + * Mon Sep 26 2022 liweiganga - 1.2.0-1 - upstream release 1.2.0 - fix: fix CVE-2016-10141、CVE-2016-7504、CVE-2016-9136、CVE-2017-5628、CVE-2016-9017、\